ai-remote 0.4.13 → 0.4.15

package/dist/cli-identities-ZILT4XCR.mjs

@@ -0,0 +1,412 @@
+import {
+  SshReader,
+  SshWriter,
+  concatBytes,
+  fromBase64,
+  padStart,
+  toBase64Url
+} from "./cli-chunk-XT2FISR5.mjs";
+
+// src/cli/identities.ts
+import { connect } from "node:net";
+import { createPrivateKey } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// src/protocols/ssh/identity.ts
+var subtle = globalThis.crypto?.subtle;
+var CURVES = {
+  "nistp256": { jwk: "P-256", hash: "SHA-256", size: 32 },
+  "nistp384": { jwk: "P-384", hash: "SHA-384", size: 48 },
+  "nistp521": { jwk: "P-521", hash: "SHA-512", size: 66 }
+};
+var RSA_HASHES = {
+  "rsa-sha2-512": "SHA-512",
+  "rsa-sha2-256": "SHA-256",
+  "ssh-rsa": "SHA-1"
+};
+var OPENSSH_MAGIC = "openssh-key-v1\0";
+var b64u = (bytes) => toBase64Url(bytes);
+function pemBody(text, label) {
+  const match = new RegExp(
+    `-----BEGIN ${label}-----([\\s\\S]*?)-----END ${label}-----`
+  ).exec(text);
+  if (!match) return null;
+  return fromBase64(match[1].replace(/\s+/g, ""));
+}
+async function parsePrivateKey(text, comment = "") {
+  const body = pemBody(text, "OPENSSH PRIVATE KEY");
+  if (body) return parseOpenSshKey(body, comment);
+  const pkcs8 = pemBody(text, "PRIVATE KEY");
+  if (pkcs8) return fromPkcs8(pkcs8, comment);
+  if (/BEGIN (RSA|EC|DSA) PRIVATE KEY/.test(text)) {
+    throw new Error(
+      "this is a legacy PEM key; convert it with `ssh-keygen -p -m RFC4716 -f <file>`"
+    );
+  }
+  if (/ENCRYPTED PRIVATE KEY/.test(text)) {
+    throw new Error("this key is encrypted; add it to ssh-agent with `ssh-add`");
+  }
+  throw new Error("this does not look like a private key");
+}
+async function parseOpenSshKey(body, comment) {
+  const magic = new TextDecoder().decode(body.subarray(0, OPENSSH_MAGIC.length));
+  if (magic !== OPENSSH_MAGIC) throw new Error("this is not an OpenSSH private key");
+  const reader = new SshReader(body, OPENSSH_MAGIC.length);
+  const cipher = reader.string();
+  reader.string();
+  reader.stringBytes();
+  const count = reader.u32();
+  if (count !== 1) throw new Error(`this file holds ${count} keys; one was expected`);
+  const keyBlob = reader.stringBytes();
+  const secret = reader.stringBytes();
+  if (cipher !== "none") {
+    throw new Error("this key has a passphrase; add it to ssh-agent with `ssh-add`");
+  }
+  const inner = new SshReader(secret, 0);
+  const check1 = inner.u32();
+  const check2 = inner.u32();
+  if (check1 !== check2) throw new Error("this key file is damaged");
+  const keyType = inner.string();
+  const identity = await fromSecret(keyType, inner, keyBlob, comment);
+  return identity.comment ? identity : { ...identity, comment: readComment(inner) };
+}
+function readComment(reader) {
+  try {
+    return reader.string();
+  } catch {
+    return "";
+  }
+}
+async function fromSecret(keyType, reader, keyBlob, comment) {
+  if (keyType === "ssh-ed25519") {
+    const publicKey = reader.stringBytes();
+    const secret = reader.stringBytes();
+    const seed = secret.subarray(0, 32);
+    return ed25519Identity(keyBlob, publicKey, seed, comment);
+  }
+  if (keyType === "ssh-rsa") {
+    const n = reader.mpint();
+    const e = reader.mpint();
+    const d = reader.mpint();
+    const iqmp = reader.mpint();
+    const p = reader.mpint();
+    const q = reader.mpint();
+    return rsaIdentity(keyBlob, { n, e, d, p, q, iqmp }, comment);
+  }
+  if (keyType.startsWith("ecdsa-sha2-")) {
+    const curve = reader.string();
+    const point = reader.stringBytes();
+    const d = reader.mpint();
+    return ecdsaIdentity(keyBlob, curve, point, d, comment);
+  }
+  throw new Error(`${keyType} keys are not supported`);
+}
+async function ed25519Identity(keyBlob, publicKey, seed, comment) {
+  const key = await importJwk(
+    { kty: "OKP", crv: "Ed25519", x: b64u(publicKey), d: b64u(seed) },
+    { name: "Ed25519" }
+  );
+  return {
+    keyType: "ssh-ed25519",
+    keyBlob: keyBlob.length ? keyBlob : blobFor("ssh-ed25519", publicKey),
+    comment,
+    algorithms: ["ssh-ed25519"],
+    async sign(data, algorithm) {
+      const signature = new Uint8Array(await subtle.sign({ name: "Ed25519" }, key, signable(data)));
+      return signatureBlob(algorithm, signature);
+    }
+  };
+}
+async function rsaIdentity(keyBlob, parts, comment) {
+  const { n, e, d, p, q, iqmp } = parts;
+  const jwk = {
+    kty: "RSA",
+    n: b64u(n),
+    e: b64u(e),
+    d: b64u(d),
+    p: b64u(p),
+    q: b64u(q),
+    // OpenSSH stores neither exponent, because a signer can derive both. A JSON
+    // Web Key wants them, so they are derived here rather than left out -- a
+    // key missing them imports as a slower non-CRT key, or not at all.
+    dp: b64u(modulo(d, minusOne(p))),
+    dq: b64u(modulo(d, minusOne(q))),
+    qi: b64u(iqmp)
+  };
+  const keys = /* @__PURE__ */ new Map();
+  const keyFor = (hash) => {
+    let pending = keys.get(hash);
+    if (!pending) {
+      pending = importJwk(jwk, { name: "RSASSA-PKCS1-v1_5", hash });
+      keys.set(hash, pending);
+    }
+    return pending;
+  };
+  return {
+    keyType: "ssh-rsa",
+    keyBlob: keyBlob.length ? keyBlob : concatBytes(
+      new SshWriter(32).string("ssh-rsa").take(),
+      new SshWriter(512).mpint(e).mpint(n).take()
+    ),
+    comment,
+    // SHA-1 last: a host new enough to refuse it will have taken one of the
+    // others, and one old enough to want it takes nothing else.
+    algorithms: ["rsa-sha2-512", "rsa-sha2-256", "ssh-rsa"],
+    async sign(data, algorithm) {
+      const hash = RSA_HASHES[algorithm] ?? "SHA-256";
+      const key = await keyFor(hash);
+      const signature = new Uint8Array(
+        await subtle.sign({ name: "RSASSA-PKCS1-v1_5" }, key, signable(data))
+      );
+      return signatureBlob(algorithm, signature);
+    }
+  };
+}
+async function ecdsaIdentity(keyBlob, curve, point, d, comment) {
+  const spec = CURVES[curve];
+  if (!spec) throw new Error(`the curve ${curve} is not supported`);
+  if (point[0] !== 4) throw new Error("the public point is in a form this cannot read");
+  const x = point.subarray(1, 1 + spec.size);
+  const y = point.subarray(1 + spec.size, 1 + spec.size * 2);
+  const key = await importJwk(
+    { kty: "EC", crv: spec.jwk, x: b64u(x), y: b64u(y), d: b64u(padStart(d, spec.size)) },
+    { name: "ECDSA", namedCurve: spec.jwk }
+  );
+  const algorithm = `ecdsa-sha2-${curve}`;
+  return {
+    keyType: algorithm,
+    keyBlob: keyBlob.length ? keyBlob : concatBytes(
+      new SshWriter(64).string(algorithm).string(curve).string(point).take()
+    ),
+    comment,
+    algorithms: [algorithm],
+    async sign(data) {
+      const raw = new Uint8Array(await subtle.sign(
+        { name: "ECDSA", hash: spec.hash },
+        key,
+        signable(data)
+      ));
+      const half = raw.length / 2;
+      const pair = new SshWriter(raw.length + 16).mpint(raw.subarray(0, half)).mpint(raw.subarray(half)).take();
+      return signatureBlob(algorithm, pair);
+    }
+  };
+}
+async function fromPkcs8(der, comment) {
+  const candidates = [
+    { name: "Ed25519" },
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    { name: "ECDSA", namedCurve: "P-256" },
+    { name: "ECDSA", namedCurve: "P-384" },
+    { name: "ECDSA", namedCurve: "P-521" }
+  ];
+  for (const algorithm of candidates) {
+    let jwk;
+    try {
+      const key = await subtle.importKey("pkcs8", signable(der), algorithm, true, ["sign"]);
+      jwk = await subtle.exportKey("jwk", key);
+    } catch {
+      continue;
+    }
+    const from = (value) => fromBase64Url(value ?? "");
+    if (jwk.kty === "OKP") {
+      const x = from(jwk.x);
+      return ed25519Identity(blobFor("ssh-ed25519", x), x, from(jwk.d), comment);
+    }
+    if (jwk.kty === "RSA") {
+      return rsaIdentity(new Uint8Array(0), {
+        n: from(jwk.n),
+        e: from(jwk.e),
+        d: from(jwk.d),
+        p: from(jwk.p),
+        q: from(jwk.q),
+        iqmp: from(jwk.qi)
+      }, comment);
+    }
+    if (jwk.kty === "EC") {
+      const curve = Object.entries(CURVES).find(([, spec2]) => spec2.jwk === jwk.crv);
+      if (!curve) continue;
+      const [name, spec] = curve;
+      const point = concatBytes(
+        new Uint8Array([4]),
+        padStart(from(jwk.x), spec.size),
+        padStart(from(jwk.y), spec.size)
+      );
+      return ecdsaIdentity(new Uint8Array(0), name, point, from(jwk.d), comment);
+    }
+  }
+  throw new Error("this key is of a type that cannot be used for SSH here");
+}
+function blobFor(type, publicKey) {
+  return new SshWriter(64).string(type).string(publicKey).take();
+}
+function signable(bytes) {
+  const copy = new Uint8Array(new ArrayBuffer(bytes.length));
+  copy.set(bytes);
+  return copy;
+}
+function signatureBlob(algorithm, signature) {
+  return new SshWriter(signature.length + 64).string(algorithm).string(signature).take();
+}
+function importJwk(jwk, algorithm) {
+  if (!subtle) throw new Error("this runtime has no Web Crypto, so it cannot sign with a key");
+  return subtle.importKey("jwk", jwk, algorithm, false, ["sign"]);
+}
+function fromBase64Url(text) {
+  const padded = text.replaceAll("-", "+").replaceAll("_", "/");
+  return fromBase64(padded + "=".repeat((4 - padded.length % 4) % 4));
+}
+var toBigInt = (bytes) => bytes.reduce((value, byte) => value << 8n | BigInt(byte), 0n);
+function toBytes(value) {
+  let hex = value.toString(16);
+  if (hex.length % 2) hex = `0${hex}`;
+  const out = new Uint8Array(hex.length / 2);
+  for (let index = 0; index < out.length; index++) {
+    out[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+  }
+  return out;
+}
+var minusOne = (bytes) => toBytes(toBigInt(bytes) - 1n);
+var modulo = (a, b) => toBytes(toBigInt(a) % toBigInt(b));
+
+// src/cli/identities.ts
+var DEFAULT_KEYS = ["id_ed25519", "id_ecdsa", "id_rsa"];
+var AGENT = {
+  REQUEST_IDENTITIES: 11,
+  IDENTITIES_ANSWER: 12,
+  SIGN_REQUEST: 13,
+  SIGN_RESPONSE: 14
+};
+var RSA_FLAGS = { "rsa-sha2-256": 2, "rsa-sha2-512": 4 };
+async function loadIdentities(paths = []) {
+  const identities = [];
+  const skipped = [];
+  if (paths.length) {
+    for (const path of paths) await readKey(path, identities, skipped, true);
+    return { identities, skipped };
+  }
+  identities.push(...await agentIdentities().catch(() => []));
+  const held = new Set(identities.map((identity) => fingerprintOf(identity.keyBlob)));
+  for (const name of DEFAULT_KEYS) {
+    const path = join(homedir(), ".ssh", name);
+    const before = identities.length;
+    await readKey(path, identities, skipped, false);
+    if (identities.length > before && held.has(fingerprintOf(identities.at(-1).keyBlob))) {
+      identities.pop();
+    }
+  }
+  return { identities, skipped };
+}
+async function readKey(path, into, skipped, wanted) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (error) {
+    const missing = error?.code === "ENOENT";
+    if (wanted) {
+      skipped.push(`${path}: ${missing ? "no such file" : error instanceof Error ? error.message : String(error)}`);
+    }
+    return;
+  }
+  try {
+    into.push(await parsePrivateKey(text, path));
+    return;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const modern = /legacy PEM/.test(message) ? toPkcs8(text) : null;
+    if (!modern) {
+      skipped.push(`${path}: ${message}`);
+      return;
+    }
+    try {
+      into.push(await parsePrivateKey(modern, path));
+    } catch (second) {
+      skipped.push(`${path}: ${second instanceof Error ? second.message : String(second)}`);
+    }
+  }
+}
+function toPkcs8(text) {
+  try {
+    const der = createPrivateKey(text).export({ type: "pkcs8", format: "der" });
+    const base64 = Buffer.from(der).toString("base64").replace(/(.{64})/g, "$1\n");
+    return `-----BEGIN PRIVATE KEY-----
+${base64}
+-----END PRIVATE KEY-----
+`;
+  } catch {
+    return null;
+  }
+}
+function fingerprintOf(keyBlob) {
+  let hash = 2166136261;
+  for (const byte of keyBlob) {
+    hash ^= byte;
+    hash = Math.imul(hash, 16777619);
+  }
+  return `${keyBlob.length}:${hash >>> 0}`;
+}
+async function agentIdentities() {
+  const socketPath = process.env.SSH_AUTH_SOCK;
+  if (!socketPath) return [];
+  const answer = await agentRequest(socketPath, new SshWriter(8).u8(AGENT.REQUEST_IDENTITIES).take());
+  const reader = new SshReader(answer, 0);
+  if (reader.u8() !== AGENT.IDENTITIES_ANSWER) return [];
+  const count = reader.u32();
+  const identities = [];
+  for (let index = 0; index < count; index++) {
+    const keyBlob = reader.stringBytes().slice();
+    const comment = reader.string();
+    const keyType = new SshReader(keyBlob, 0).string();
+    identities.push({
+      keyType,
+      keyBlob,
+      comment: comment || `${keyType} (agent)`,
+      algorithms: keyType === "ssh-rsa" ? ["rsa-sha2-512", "rsa-sha2-256", "ssh-rsa"] : [keyType],
+      async sign(data, algorithm) {
+        const request = new SshWriter(keyBlob.length + data.length + 32).u8(AGENT.SIGN_REQUEST).string(keyBlob).string(data).u32(RSA_FLAGS[algorithm] ?? 0).take();
+        const response = new SshReader(await agentRequest(socketPath, request), 0);
+        if (response.u8() !== AGENT.SIGN_RESPONSE) {
+          throw new Error(`the agent would not sign with ${comment || keyType}`);
+        }
+        return response.stringBytes().slice();
+      }
+    });
+  }
+  return identities;
+}
+function agentRequest(socketPath, payload, timeoutMs = 5e3) {
+  return new Promise((resolve, reject) => {
+    const socket = connect(socketPath);
+    const chunks = [];
+    let length = -1;
+    const fail = (error) => {
+      socket.destroy();
+      reject(error);
+    };
+    socket.setTimeout(timeoutMs, () => fail(new Error("ssh-agent did not answer")));
+    socket.on("error", fail);
+    socket.on("connect", () => {
+      const header = Buffer.alloc(4);
+      header.writeUInt32BE(payload.length, 0);
+      socket.write(Buffer.concat([header, Buffer.from(payload)]));
+    });
+    socket.on("data", (chunk) => {
+      chunks.push(chunk);
+      const buffer = Buffer.concat(chunks);
+      if (length < 0 && buffer.length >= 4) length = buffer.readUInt32BE(0);
+      if (length >= 0 && buffer.length >= length + 4) {
+        socket.end();
+        resolve(new Uint8Array(buffer.subarray(4, 4 + length)));
+      }
+    });
+    socket.on("close", () => {
+      if (length < 0) reject(new Error("ssh-agent closed the connection"));
+    });
+  });
+}
+export {
+  agentIdentities,
+  loadIdentities
+};

package/dist/cli-secrets-26D3F6EN.mjs

@@ -0,0 +1,218 @@
+// src/cli/secrets.ts
+import { spawn } from "node:child_process";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+var SERVICE = "ai-remote";
+function configDir() {
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, "ai-remote");
+}
+var legacyDir = () => join(homedir(), ".ai-remote");
+var indexPath = (directory) => join(directory, "credentials.json");
+var keyPath = (directory) => join(directory, "credentials.key");
+function secretKey(host, port, username) {
+  return `${username || "anonymous"}@${host}:${port}`;
+}
+function readIndex(directory) {
+  try {
+    const parsed = JSON.parse(readFileSync(indexPath(directory), "utf8"));
+    return { entries: Array.isArray(parsed.entries) ? parsed.entries : [] };
+  } catch {
+    return { entries: [] };
+  }
+}
+function findEntry(key) {
+  for (const directory of [configDir(), legacyDir()]) {
+    const entry = readIndex(directory).entries.find((candidate) => candidate.key === key);
+    if (entry) return { entry, directory };
+  }
+  return null;
+}
+function writeIndex(directory, index) {
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  writeFileSync(indexPath(directory), `${JSON.stringify(index, null, 2)}
+`, { mode: 384 });
+  chmodSync(indexPath(directory), 384);
+}
+function run(command, args, input) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], detached: true });
+    let out = "";
+    child.stdout.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.stderr.on("data", () => {
+    });
+    child.on("error", () => resolve({ code: -1, out: "" }));
+    child.on("close", (code) => resolve({ code: code ?? -1, out }));
+    if (input !== void 0) child.stdin.end(input);
+    else child.stdin.end();
+  });
+}
+var has = async (command) => (await run("command", ["-v", command])).code === 0 || (await run(command, ["--version"])).code >= 0;
+async function chooseBackend(secret) {
+  const asked = process.env.AI_REMOTE_SECRET_BACKEND;
+  if (asked === "file" || asked === "keychain" || asked === "secret-service") return asked;
+  if (secret.includes("\n")) return "file";
+  if (platform() === "darwin") return "keychain";
+  if (platform() === "linux" && await has("secret-tool")) return "secret-service";
+  return "file";
+}
+async function writeToStore(backend, key, secret) {
+  if (backend === "keychain") {
+    const { code } = await run(
+      "security",
+      ["add-generic-password", "-U", "-s", SERVICE, "-a", key, "-D", "ai-remote password", "-w"],
+      `${secret}
+${secret}
+`
+    );
+    return code === 0;
+  }
+  if (backend === "secret-service") {
+    const { code } = await run(
+      "secret-tool",
+      ["store", "--label", `ai-remote ${key}`, "service", SERVICE, "account", key],
+      secret
+    );
+    return code === 0;
+  }
+  return false;
+}
+async function readFromStore(backend, key) {
+  if (backend === "keychain") {
+    const { code, out } = await run(
+      "security",
+      ["find-generic-password", "-s", SERVICE, "-a", key, "-w"]
+    );
+    return code === 0 ? out.replace(/\n$/, "") : "";
+  }
+  if (backend === "secret-service") {
+    const { code, out } = await run("secret-tool", ["lookup", "service", SERVICE, "account", key]);
+    return code === 0 ? out : "";
+  }
+  return "";
+}
+async function deleteFromStore(backend, key) {
+  if (backend === "keychain") {
+    await run("security", ["delete-generic-password", "-s", SERVICE, "-a", key]);
+  }
+  if (backend === "secret-service") {
+    await run("secret-tool", ["clear", "service", SERVICE, "account", key]);
+  }
+}
+function fileKey(directory) {
+  const path = keyPath(directory);
+  if (existsSync(path)) {
+    const key2 = readFileSync(path);
+    if (key2.length === 32) return new Uint8Array(key2);
+  }
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  const key = randomBytes(32);
+  writeFileSync(path, key, { mode: 384 });
+  chmodSync(path, 384);
+  return new Uint8Array(key);
+}
+function encrypt(directory, secret) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", fileKey(directory), iv);
+  const data = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
+  return {
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    data: data.toString("base64")
+  };
+}
+function decrypt(directory, stored) {
+  const decipher = createDecipheriv(
+    "aes-256-gcm",
+    fileKey(directory),
+    Buffer.from(stored.iv, "base64")
+  );
+  decipher.setAuthTag(Buffer.from(stored.tag, "base64"));
+  return Buffer.concat([
+    decipher.update(Buffer.from(stored.data, "base64")),
+    decipher.final()
+  ]).toString("utf8");
+}
+async function saveSecret(key, secret) {
+  const directory = configDir();
+  let backend = await chooseBackend(secret);
+  if (backend !== "file" && !await writeToStore(backend, key, secret)) {
+    backend = "file";
+  }
+  const index = readIndex(directory);
+  index.entries = index.entries.filter((entry) => entry.key !== key);
+  index.entries.push({
+    key,
+    backend,
+    savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    secret: backend === "file" ? encrypt(directory, secret) : void 0
+  });
+  writeIndex(directory, index);
+  return { backend, where: describe(backend, directory) };
+}
+function describe(backend, directory = configDir()) {
+  if (backend === "keychain") return "your login keychain";
+  if (backend === "secret-service") return "your desktop keyring";
+  return `${indexPath(directory)}, encrypted under a key in the same directory`;
+}
+function backendName(backend) {
+  if (backend === "keychain") return "login keychain";
+  if (backend === "secret-service") return "desktop keyring";
+  return "encrypted file";
+}
+async function loadSecret(key) {
+  const found = findEntry(key);
+  if (!found) return "";
+  const { entry, directory } = found;
+  if (entry.backend === "file") {
+    if (!entry.secret) return "";
+    try {
+      return decrypt(directory, entry.secret);
+    } catch {
+      return "";
+    }
+  }
+  return readFromStore(entry.backend, key);
+}
+async function forgetSecret(key) {
+  let forgotten = false;
+  for (const directory of [configDir(), legacyDir()]) {
+    const index = readIndex(directory);
+    const entry = index.entries.find((candidate) => candidate.key === key);
+    if (!entry) continue;
+    if (entry.backend !== "file") await deleteFromStore(entry.backend, key);
+    index.entries = index.entries.filter((candidate) => candidate.key !== key);
+    writeIndex(directory, index);
+    forgotten = true;
+  }
+  return forgotten;
+}
+function savedSecrets() {
+  const seen = /* @__PURE__ */ new Map();
+  for (const directory of [configDir(), legacyDir()]) {
+    for (const entry of readIndex(directory).entries) {
+      if (!seen.has(entry.key)) seen.set(entry.key, entry);
+    }
+  }
+  return [...seen.values()].map(({ key, backend, savedAt }) => ({ key, backend, savedAt })).sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+}
+async function forgetAll() {
+  const keys = savedSecrets().map((entry) => entry.key);
+  for (const key of keys) await forgetSecret(key);
+  return keys.length;
+}
+export {
+  backendName,
+  configDir,
+  describe,
+  forgetAll,
+  forgetSecret,
+  loadSecret,
+  saveSecret,
+  savedSecrets,
+  secretKey
+};

package/dist/cli-shell-TE6DLBIB.mjs

@@ -0,0 +1,10 @@
+import {
+  Shell,
+  bareUsername
+} from "./cli-chunk-RBCU3NX4.mjs";
+import "./cli-chunk-EYQCDSPT.mjs";
+import "./cli-chunk-XT2FISR5.mjs";
+export {
+  Shell,
+  bareUsername
+};

package/dist/cli-window-LN32ONC4.mjs

@@ -0,0 +1,15 @@
+import {
+  detectCurrentDisplaySize,
+  nativeWindowAvailable,
+  openWindow,
+  readCurrentDisplaySize,
+  runWindow
+} from "./cli-chunk-7UHHVT7Q.mjs";
+import "./cli-chunk-K2DYJXC5.mjs";
+export {
+  detectCurrentDisplaySize,
+  nativeWindowAvailable,
+  openWindow,
+  readCurrentDisplaySize,
+  runWindow
+};